65 lines
1.9 KiB
Docker
65 lines
1.9 KiB
Docker
# =============================================================================
|
|
# 小虾 SaaS API 多阶段构建
|
|
# =============================================================================
|
|
# Stage 1: Builder - 安装依赖
|
|
FROM python:3.12-slim AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# 安装构建依赖
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
gcc \
|
|
libpq-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# 复制依赖文件并安装
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir --user --upgrade pip setuptools wheel && \
|
|
pip install --no-cache-dir --user -r requirements.txt
|
|
|
|
# =============================================================================
|
|
# Stage 2: Runtime - 运行镜像
|
|
FROM python:3.12-slim AS runtime
|
|
|
|
# 安全：使用非 root 用户
|
|
RUN groupadd --gid 1000 appgroup && \
|
|
useradd --uid 1000 --gid appgroup --shell /bin/bash --create-home appuser
|
|
|
|
WORKDIR /app
|
|
|
|
# 设置环境变量
|
|
ENV PYTHONPATH=/app \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/ \
|
|
PIP_TRUSTED_HOST=mirrors.aliyun.com
|
|
|
|
# 安装运行时依赖（排除构建工具）
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libpq5 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# 从 builder 阶段复制已安装的包
|
|
COPY --from=builder /root/.local /home/appuser/.local
|
|
COPY --from=builder /app /app
|
|
|
|
# 设置 PATH 包含用户本地 bin
|
|
ENV PATH=/home/appuser/.local/bin:$PATH
|
|
|
|
# 复制应用代码
|
|
COPY --chown=appuser:appgroup apps/api /app/apps/api
|
|
COPY --chown=appuser:appgroup packages /app/packages
|
|
COPY --chown=appuser:appgroup scripts /app/scripts
|
|
COPY --chown=appuser:appgroup alembic /app/alembic
|
|
COPY --chown=appuser:appgroup alembic.ini /app/alembic.ini
|
|
|
|
# 切换到非 root 用户
|
|
USER appuser
|
|
|
|
WORKDIR /app/apps/api
|
|
|
|
EXPOSE 8000
|
|
|
|
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
|